Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I don’t know what happened, but the Shopify Webhook “apps/uninstalled” is not returning a “HTTP_X_SHOPIFY_HMAC_SHA256” value. It’s no where in the request. Without the HMAC, there is no way to verify the call is for Shopify.
I’m seeing my other Webhook calls are getting a HTTP_X_SHOPIFY_HMAC_SHA256 value, but its completely missing in the “apps/uninstalled” webhook.
Any ideas on what I’m doing wrong? Is Shopify just having issues right now?
thanks!
Thanks again for the headsup! This issue was introduced on Friday evening.
We have confirmed exactly 50 api permissions deleted since then that did not send the HMAC header for the “app/uninstall” webhook subscription. We fixed the issue today and resent the “app/uninstall” webhook notification for all affected apps.
Let us know in case you’re still seeing any unexpected irregularities!
Best, Dennis
Technical Support Engineer
Shopify